ThinAir CEO Tony Gauda on Insider Threats (Podcast)

ThinAirIn Preston’s absence, I spoke with ThinAir CEO Tony Gauda about insider threats. Insider threats cost companies billions of dollars, thousands of lost labor hours, and loss of credibility with customers. If you don’t believe that insider threats are a real problem, it might interest you to know that among companies experiencing data breaches, internal actors were responsible for 43 percent of data loss, half of which was intentional and half accidental.

There are two types of insider threats that are mentioned above:

  1. The malicious insider who purposely steals data, and
  2. The unaware or innocent insider who accidentally causes a breach.

From the ThinAir website:

The average cost of a data breach is now $3.62 million, up 16% since 2013, according to a recent IBM-Ponemon report. It only takes minutes for a thief to steal information, but organizations typically need 191 days to identify a breach and another 66 days to contain it. The two major costs are related to an investigation, and the forensics to determine the root cause and the scope. Factor in the inevitable lawsuits, customer churn, and brand damage, and an organization will feel the effects of a breach for years to come.

What if instead of attempting to reconstruct the crime scene, you could play back the security tape in high definition? What if you knew the source, complete impact, and vector of exfiltration in 90 seconds?

The problem is real and it’s expensive. Tony Gauda and I explore the many possibilities and some solutions to the problem in this podcast.

Podcast details:

Length: 20:39 mins. Format: MP3. Rating: G for all audiences.

Thanks to Tony Gauda and Caitlin Gribbons at Inkhouse for connecting us.

ISACA Report Confirms SSH Keys Need To Be Properly Managed To Ensure Compliance and Reduce Risk

HELSINKI, WALTHAM, Mass. and ROLLING MEADOWS, Ill., Sept. 12, 2017 – The use of Secure Shell (SSH) is ubiquitous, a critical service on which the security profile of most organizations depends. Yet, according to a new report issued by ISACA and sponsored by SSH Communications Security, only rarely is that usage appropriately secured, assessed, documented and managed in a systematic and risk-aware way. Consequently, poorly managed SSH key environments may lead to compliance challenges and security breaches. The full report can be downloaded free of charge from the ISACA or SSH Communications Security websites.

The report outlines considerations that technology risk professionals, auditors, security practitioners and governance professionals should take into account as they approach the use of SSH in their enterprises. It offers guidance for the assessment of SSH usage, including items to incorporate in audit plans to ensure SSH access control and management is in place. Key areas auditors should consider regarding SSH keys include:

  • Security issues: Practical challenges include managing and tracking cryptographic keys at scale, responsibility for “key hygiene” and executive oversight for the use of SSH.
  • Assurance considerations:The ubiquity and transparency of SSH access makes the surface area for consideration very large, while the underlying mechanics of operation make it specialized and potentially complex. The report explores the core areas that auditors should consider when evaluating SSH usage.
  • Suggested controls: ISACA recommends specific areas to focus on when evaluating enterprise networks for SSH compliance, including configuration management and provisioning.

Frank Schettini, Chief Innovation Officer, ISACA, said: “SSH is one of those rare technologies that is in frequent use in almost every type of organization around the world. The report from ISACA examines the specific steps audit practitioners should take to ensure that they are not ignoring SSH usage and the access it provides, and gives general guidance on appropriate controls to assess and manage SSH keys. Our goal is to provide a practical starting point for improving any organization’s security posture and overall governance.”

Fouad Khalil, VP of Compliance, SSH Communications Security, said:

“Audit, risk, security and governance practitioners have a huge and complex job on their hands when it comes to SSH user key management. ISACA’s new report recommends that practitioners systematically address, assess and periodically re-evaluate the mechanics of SSH usage within their environments. Our robust set of solutions removes the complexity and difficulty from these urgent, critical tasks so organizations can become or remain secure and compliant.”

About ISACA

Nearing its 50th year, ISACA® (isaca.org) is a global association helping individuals and enterprises achieve the positive potential of technology. ISACA leverages the expertise of its half-million engaged professionals in information and cyber security, governance, assurance, risk and innovation, as well as its enterprise performance subsidiary, CMMI® Institute, to help advance innovation through technology.

About SSH Communications Security

SSH Communications Security (NASDAQ OMX) is a leading provider of enterprise cybersecurity solutions that monitor, control and automate trusted access to critical data. Customers worldwide trust our flagship Universal SSH Key Manager® and other solutions to manage access, enhance security and achieve compliance. SSH sells direct through offices in North America, Europe and Asia and through a global network of certified partners. Access more at www.ssh.com

“Manage Access, Not Keys” with Tatu Ylönen (Podcast)

SSH CommunicationsGreetings SSH fans. Preston and I had the pleasure of speaking with SSH Communications Security founder Tatu Ylönen about keyless access and how system administrators and system security professionals should “manage access, not keys” when using the SSH protocol.

Preston and I debate the security of a decision to use passwordless and keyless access. During the call, we asked how to implement keyless access and what the deployment looks like to a system administrator. Preston and I are both system administrators, so we are definitely interested in the ins-and-outs of deployment.

Tatu YlönenAs always, Tatu is very engaging and extremely knowledgeable about the topic of security, SSH, and access management.

Podcast details:

Length: 15:52 minutes. Format: MP3. Rating: G for all audiences.

Copyright 2017 SecurityNOW. License: CC BY.

Cybersecurity Law with Heidi L. Shadid, Attorney at Law (Video)

Eller & DetrichHeidi Shadid of the Eller & Detrich Law Firm and I sat down for an interview that covered several aspects of Cybersecurity Law. We discussed how to engage her firm, what to do after a hack or breach, and what your responsibilities are for reporting a breach. Ms. Shadid is an Attorney with the Eller & Detrich Law Firm in Tulsa, Oklahoma and includes Cybersecurity Law in her practice.

Her practice encompasses the following specialties:

Core areas of practice and experience

  • General Civil Litigation
  • Business Litigation
  • Construction Litigation
  • Employment Disputes
  • Cybersecurity Risk Management

Bar admissions

  • Oklahoma, 2010
  • Missouri, 2009
  • Kansas, 2009
  • U.S. District Court, Northern, Eastern & Western Districts of Oklahoma
  • U.S. District Court, District of Kansas
  • U.S. District Court, Western District of Missouri
  • U.S. District Court, District of Colorado
  • U.S. Court of Appeals, Tenth Circuit

Copyright 2017 SecurityNOW – License: CC BY

Protecting Your Cyberlife

By Preston Smith

How significant are foreign hacks and cyber threats to the average person?

Does the thought of foreign hackers enter our daily lives?

Does anyone stop and think, “Wow, right now there are possibly thousands of entities trying to break into my cyberlife.”?

Don’t make the mistake of thinking it’s just the work side of your cyberlife that they’re trying to gain access to. There may be more information from an organization, but if they can get even a little bit of your personal information, they’re going to try and get it!
Most of the time it isn’t even people who are testing and trying out ways to get into information. Often, it’s just a bot trying any IP addresses that it can reach. If a bot hits an IP address and receives an open request for a login, that response forwards onto the next bot that attempts to guess login credentials. Then that bot keeps trying, following whatever “might” be a logical limit (if the owner or admin bothered to set that option) on login attempts, so as not to lock out the account until it gains access.

A bot doesn’t care about how quickly it can access an account.; it can be very patient, especially since few, if anyone, checks access to accounts or, heaven forbid, to regularly change passwords! Of course, once a bot successfully logs in, it probably gives notification to the organization (or to the country) that started the bot so that the attacker can infiltrate and either place Stealth viruses or another bot to collect information, onto compromised systems.
The really challenging bots are some that have learned to hide on our systems. They collect everything about us that we put into a computer that we think is safe. Again, this is something that can happen on your home computer as well as on your work computer.

I don’t want to make us all psychotic about using our cyber devices. But I do want us to realize that international and foreign hackers are not just on the government’s doorstep! They’re at your door if you have any device with an IP address! Instead of freaking out about it and shutting everything off, let’s apply logic and strategy and make security a habit, not a chore. Use password managers so they can help us track how often to change passwords and to not use duplicate passwords anywhere.

Update software and firmware on everything. Don’t delay installing the latest updates as they usually include important security patches! Also, since firmware doesn’t seem to let us know when there’s a new version available, put together a calendar reminder to check your firmware on a regular basis!

Always have at least one (or even more) of the well-known antivirus software applications running on any device that it can be installed! Check that you have set your settings at a secure mode. Don’t ever accept the default settings from a program or an application. Read the options carefully, find what you would be comfortable with, and then set it one level higher (more restrictive) than you want.

Remember, it’s too easy to forget how much the bad guys want to get into your cyberlife! Think about things like “Does this device connect to the Internet?” “Does it have a login?” And here is the difficult question that really requires thought, “If someone gained access to this device, what information could they get or how much access would they have to my cyberlife?”

We must realize that our comfortable and exciting cyberlife is not the safest of environments. All it takes to feel more comfortable with our cyber choices is to be sure that we take complete control and know our risks and our protections.

Black Hat 2017 Conference Trends with Richard Henderson (Podcast)

Black Hat 2017I’ve never been to a Black Hat Conference but I’d love to go. Richard Henderson, Global Security Strategist for Absolute and regular SecurityNOW podcast guest, is going. Before he left, he shared some ideas and trends for this year’s conference in fabulous Las Vegas.
Richard and I discuss a lot of different things in this episode but our main focus is Black Hat 2017 and what he thinks the trends are going to be.

I think this was a fun one. Unfortunately, Preston was not able to join us, but we had a good time anyway. Richard is always a great guest and I think you’ll enjoy hearing a longer, calmer podcast than usual.

Podcast details:

Length: 36:22 minutes. Format: MP3. Rating: G for all audiences.

Copyright SecurityNOW 2017. License: CC BY

Social Media Security with Proofpoint’s Dan Nadir (Podcast)

ProofpointPreston and I had the opportunity to speak with Proofpoint‘s Vice President of Digital Risk on the hot topic of social media security. I say it’s a hot topic because it’s a hot topic for me because I’m not really a fan of most social media sites. I generally only use LinkedIn and Twitter. But there’s more to social media than Facebook, Twitter, and LinkedIn. There’s Instagram, Snapchat, and others. And security for all them is a big concern–or should be. In this podcast, we discuss the problems with social media security and some possible solutions.

Listen in and tell us what you think.

Podcast details:

Length: 19:59 minutes. Format: MP3. Rating: G for all audiences.

Copyright 2017 SecurityNOW  Licensing: CCBY